Own the IT evidence program across ISO 27001:2022, SOC 1, SOC 2, PCI DSS, and HIPAA for a portfolio of approximately thirteen operating sites.

Act as IT's counterpart to external certification bodies and auditors — prepare for audits, present and defend control evidence, and own remediation of IT findings through to closure.

Manage third-party and vendor risk management for IT: vendor security assessments, a maintained vendor register with periodic reassessment.

Own customer-facing security due diligence — questionnaires, audits and assessments.

Maintain the IT risk register and opportunities-for-improvement log, and drive items to closure rather than allowing them to age.

Coordinate IT participation in business continuity and disaster recovery testing, and ensure results are documented.

Manage vulnerability management end to end — scanning coverage, triage, remediation ownership, escalation of anything aging, and periodic reporting to leadership.

Work along side counterparts to oversee endpoint detection and response and the security alerting pipeline; ensure alerts reach an owner and that investigations are recorded and closed.

Lead security incident response — containment, investigation, root cause, customer-facing incident reporting, and post-incident hardening.

Manage email security, including domain authentication posture and secure email gateway configuration.

Run the security awareness program — monthly phishing simulation, results analysis, and targeted follow-up.

Contribute to identity governance across a hybrid estate spanning cloud and on-premises IdP

Oversee access review cadence, privileged access controls, and the joiner-mover-leaver process from an IT control standpoint, including third-party and contractor access.

Own the IT evidence program across ISO 27001:2022, SOC 1, SOC 2, PCI DSS, and HIPAA for a portfolio of approximately thirteen operating sites.

Act as IT's counterpart to external certification bodies and auditors — prepare for audits, present and defend control evidence, and own remediation of IT findings through to closure.

Manage third-party and vendor risk management for IT: vendor security assessments, a maintained vendor register with periodic reassessment.

Own customer-facing security due diligence — questionnaires, audits and assessments.

Maintain the IT risk register and opportunities-for-improvement log, and drive items to closure rather than allowing them to age.

Coordinate IT participation in business continuity and disaster recovery testing, and ensure results are documented.

Manage vulnerability management end to end — scanning coverage, triage, remediation ownership, escalation of anything aging, and periodic reporting to leadership.

Work along side counterparts to oversee endpoint detection and response and the security alerting pipeline; ensure alerts reach an owner and that investigations are recorded and closed.

Lead security incident response — containment, investigation, root cause, customer-facing incident reporting, and post-incident hardening.

Manage email security, including domain authentication posture and secure email gateway configuration.

Run the security awareness program — monthly phishing simulation, results analysis, and targeted follow-up.

Contribute to identity governance across a hybrid estate spanning cloud and on-premises IdP

Oversee access review cadence, privileged access controls, and the joiner-mover-leaver process from an IT control standpoint, including third-party and contractor access.